CVE-2026-15142 is a privilege escalation vulnerability in the Real Estate Manager Pro plugin for WordPress. The vulnerability is caused by improper privilege management in the allow_attachment_actions() function, which incorrectly treats a target user ID as a media attachment ID during capability checks. As a result, authenticated attackers with Subscriber-level access or above can edit administrator accounts and escalate their privileges to Administrator if the targeted user ID matches a media attachment ID. This affects all versions up to and including 12.8.6.

Successful exploitation allows an authenticated user with low-level privileges (Subscriber or higher) to escalate their privileges to Administrator, potentially gaining full control over the WordPress site. This can lead to complete compromise of the affected website, including unauthorized content modification, user management, and other administrative actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user access and monitor for suspicious privilege escalation attempts. Avoid targeting user IDs that match media attachment IDs as a temporary precaution.